cohorte 2.10.1 → 3.0.0-dev.0

package/dist/chunks/catalogue-BvwSrM_j.mjs

@@ -0,0 +1,1549 @@
+import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
+import { M as NotImplemented, o as err, s as ok } from "./src-Cu3TxNob.mjs";
+import { c as AgentOutput, g as ClosedEnum, o as toStrictSchema } from "./src-s7YRvk0t.mjs";
+import { l as DEFAULT_NETWORK_POLICY } from "./schema-C9QbUW4H.mjs";
+import { c as toolGrantProblems, f as AGENT_GIT_DENIED_SUBCOMMANDS, h as isTrampoline, m as PROTECTED_REPO_GLOBS, s as ToolGrant } from "./src-CId6kMsY.mjs";
+import { createHash } from "node:crypto";
+import { Type } from "typebox";
+import { Compile } from "typebox/compile";
+import { readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve } from "node:path";
+import { accessSync, constants, lstatSync, readdirSync, realpathSync } from "node:fs";
+import picomatch from "picomatch";
+//#region ../../packages/security/src/decide/commands/profiles.ts
+/** True for a token that starts a run of leading options, e.g. `-C`, `--dir=x`, `-e"code"`. */
+const isFlagToken = (token) => token.startsWith("-") && token !== "-";
+/** True when `token` invokes `flag`, whether joined by `=` (long options) or directly attached (short options). */
+function matchesFlag(token, flag) {
+	if (token === flag) return true;
+	if (flag.startsWith("--")) return token.startsWith(`${flag}=`);
+	return flag.length === 2 && token.length > flag.length && token.startsWith(flag);
+}
+/**
+* One shared structural parser for every built-in profile: walk leading flag tokens (denying a re-targeting one on
+* sight), the first non-flag token is the subcommand, everything after it splits into `flags` / `positionals` by
+* whether it starts with `-`. This is a STRUCTURAL split, not a full CLI grammar: it does not know which flags of
+* `git commit -m <msg>` consume a value, because the callers that need that (CommandRule matching) work in terms of
+* flag NAMES and positional VALUES declared by policy data, never by re-deriving one CLI's full option grammar here.
+*/
+function createProfile(spec) {
+	return {
+		program: spec.program,
+		aliases: spec.aliases,
+		parse(args) {
+			const retargeted = (token) => {
+				const denied = spec.retargeting.find((flag) => matchesFlag(token, flag));
+				if (denied === void 0) return void 0;
+				return {
+					kind: "denied",
+					code: "security/command-global-option",
+					token,
+					reason: `${spec.program}: \`${denied}\` re-targets the command onto a different directory or repository`
+				};
+			};
+			const globals = [];
+			let index = 0;
+			while (index < args.length) {
+				const token = args[index];
+				if (token === void 0 || !isFlagToken(token)) break;
+				const denial = retargeted(token);
+				if (denial !== void 0) return denial;
+				globals.push(token);
+				index += 1;
+			}
+			const subcommandToken = args[index];
+			const subcommand = subcommandToken === void 0 ? [] : [subcommandToken];
+			const rest = subcommandToken === void 0 ? [] : args.slice(index + 1);
+			const flags = [];
+			const positionals = [];
+			for (const token of rest) (isFlagToken(token) ? flags : positionals).push(token);
+			for (const token of flags) {
+				const denial = retargeted(token);
+				if (denial !== void 0) return denial;
+			}
+			return {
+				kind: "parsed",
+				globals,
+				subcommand,
+				flags,
+				positionals
+			};
+		}
+	};
+}
+const GIT_RETARGETING = [
+	"-C",
+	"-c",
+	"--config-env",
+	"--git-dir",
+	"--work-tree",
+	"--exec-path",
+	"--namespace",
+	"--super-prefix",
+	"--attr-source"
+];
+const PNPM_RETARGETING = [
+	"-C",
+	"--dir",
+	"--prefix"
+];
+const NPM_RETARGETING = ["--prefix"];
+const NODE_RETARGETING = [
+	"-e",
+	"-p",
+	"-r",
+	"--require",
+	"--import",
+	"--loader",
+	"--experimental-loader",
+	"--eval",
+	"--env-file",
+	"--env-file-if-exists"
+];
+/** `yarn --cwd <dir>` runs the whole command in another directory: `git -C` under another name. */
+const YARN_RETARGETING = ["--cwd"];
+/** `docker -H`/`--host`/`--context` re-target the DAEMON (a remote one included); `--config` the credential store. */
+const DOCKER_RETARGETING = [
+	"-H",
+	"--host",
+	"--context",
+	"--config"
+];
+const GIT_PROFILE = createProfile({
+	program: "git",
+	aliases: [],
+	retargeting: GIT_RETARGETING
+});
+const PNPM_PROFILE = createProfile({
+	program: "pnpm",
+	aliases: [],
+	retargeting: PNPM_RETARGETING
+});
+const NPM_PROFILE = createProfile({
+	program: "npm",
+	aliases: [],
+	retargeting: NPM_RETARGETING
+});
+const YARN_PROFILE = createProfile({
+	program: "yarn",
+	aliases: [],
+	retargeting: YARN_RETARGETING
+});
+const NODE_PROFILE = createProfile({
+	program: "node",
+	aliases: [],
+	retargeting: NODE_RETARGETING
+});
+/** `docker-compose up` normalises to `docker compose up`: EV-10. */
+const DOCKER_PROFILE = createProfile({
+	program: "docker",
+	aliases: ["docker-compose"],
+	retargeting: DOCKER_RETARGETING
+});
+const BUILTIN_PROFILES = Object.freeze([
+	GIT_PROFILE,
+	PNPM_PROFILE,
+	NPM_PROFILE,
+	YARN_PROFILE,
+	NODE_PROFILE,
+	DOCKER_PROFILE
+]);
+/**
+* Subcommand tokens an alias implies, prepended to argv[1..] before the matched profile parses it: `docker-compose`
+* behaves as `docker compose`. No other built-in alias carries an implied subcommand.
+*/
+const ALIAS_SUBCOMMAND_PREFIX = Object.freeze({ "docker-compose": Object.freeze(["compose"]) });
+/** `bareName` is argv[0] as typed (already checked to be a bare name with no path separator). */
+function findProfile(bareName, profiles) {
+	for (const profile of profiles) {
+		if (profile.program === bareName) return {
+			profile,
+			prefix: []
+		};
+		if (profile.aliases.includes(bareName)) return {
+			profile,
+			prefix: ALIAS_SUBCOMMAND_PREFIX[bareName] ?? []
+		};
+	}
+}
+//#endregion
+//#region ../../packages/security/src/decide/commands/resolver.ts
+const NODE_FS = {
+	accessSync,
+	realpathSync
+};
+/**
+* `bareName` SHOULD already be a bare name (no path separator): that is checked one layer up, as the very first
+* thing `evaluate()` does (DESIGN 2.6.4 step 1). This resolver enforces it too, defensively: `node:path.join`
+* normalises a segment like `./node` or `../x` away, so without this guard a relative-looking name would silently
+* resolve through directory-list normalisation rather than being rejected outright, for any OTHER caller of this
+* port that does not repeat the step-1 check.
+*/
+function createProgramResolver(options) {
+	const dirs = [...options.pathDirs];
+	const fs = options.fs ?? NODE_FS;
+	const cache = /* @__PURE__ */ new Map();
+	return { resolve(bareName) {
+		if (bareName === "" || bareName.includes("/") || bareName.includes("\\")) return void 0;
+		const cached = cache.get(bareName);
+		if (cached !== void 0 || cache.has(bareName)) return cached;
+		let found;
+		for (const dir of dirs) {
+			const candidate = join(dir, bareName);
+			try {
+				fs.accessSync(candidate, constants.X_OK);
+				found = fs.realpathSync(candidate);
+				break;
+			} catch {}
+		}
+		cache.set(bareName, found);
+		return found;
+	} };
+}
+//#endregion
+//#region ../../packages/security/src/decide/commands/index.ts
+const tokensEqual = (a, b) => a.length === b.length && a.every((value, index) => value === b[index]);
+/** `path` inside `root`, by path SEGMENTS (never `startsWith` alone: `/w/api` must not contain `/w/api-gateway`). */
+const isContainedIn = (path, root) => path === root || path.startsWith(`${root}/`);
+/**
+* "Anything not allowed is denied" (DESIGN 2.6.4) is a rule about what may be PERMITTED, so the allowlist only ever
+* narrows an `allow` rule — where narrowing fails closed. Applied to a `deny` or an `ask` rule it narrows in the
+* other direction: the restrictive rule stops matching as soon as a flag it did not declare is present, while a
+* broader `allow` rule that DOES list that flag keeps matching, and `deny > ask > allow` (step 5) is defeated by one
+* token (`pnpm --silent run build`). A restrictive rule therefore matches on program + subcommand + positionals
+* alone. Recorded in docs/v3/requests/U1.03.md R4 item 3.
+*/
+function flagsMatch(flags, rule) {
+	if (flags.length === 0 || rule.decision !== "allow") return true;
+	const spec = rule.flags;
+	if (spec === void 0) return false;
+	return flags.every((flag) => !spec.deny?.includes(flag) && spec.allow.includes(flag));
+}
+/** Structural, not filesystem-aware: real containment/symlink checks of path-typed arguments are stage 3's job. */
+const looksLikeWorktreeRelativePath = (value) => !value.startsWith("-") && !value.startsWith("/") && !value.startsWith("~") && !value.split(/[/\\]/).includes("..");
+function positionalsMatch(positionals, spec) {
+	if (spec === void 0) return positionals.length === 0;
+	switch (spec.kind) {
+		case "none": return positionals.length === 0;
+		case "exact": return tokensEqual(positionals, spec.values);
+		case "enum": return positionals.length > 0 && positionals.length <= spec.max && positionals.every((value) => spec.values.includes(value));
+		case "paths-in-worktree": return positionals.length > 0 && positionals.length <= spec.max && positionals.every(looksLikeWorktreeRelativePath);
+	}
+}
+/** A rule with no `subcommand`, no `flags` and `positionals.kind: 'exact'` matches the WHOLE rest of argv, whether
+* or not the program has a profile: this is how `dangerousCommands` and `checksToCommandRules` rules match. */
+function matchesExactArgv(rule, rest) {
+	if (rule.subcommand !== void 0 || rule.flags !== void 0) return false;
+	const positionals = rule.positionals;
+	return positionals !== void 0 && positionals.kind === "exact" && tokensEqual(rest, positionals.values);
+}
+/**
+* Only reachable for a profiled program: `(subcommand, flags, positionals)`, per DESIGN 2.6.4 step 4.
+*
+* The profile's structural split is deliberately shallow — the FIRST non-flag token is `subcommand`, every later
+* non-flag token is a positional — so a rule's `subcommand` is matched as a PREFIX of the whole non-flag token
+* stream. That is what makes DESIGN 2.6.4's own example (`subcommand: ['run','test']`) and `['compose','up']`
+* reachable, and it keeps `docker-compose up` ≡ `docker compose up`. The tokens the prefix consumes are removed
+* before the positional check; an absent or empty `subcommand` is "no subcommand constraint", not "never matches".
+*
+* Deviation (recorded): a rule's `flags` allowlist is matched against `globals` TOO, not only against the flags
+* that follow the subcommand. DESIGN 2.6.4 says of `flags` "anything not allowed is denied"; leaving the leading
+* globals unchecked would let `pnpm --silent run test` satisfy a rule written for `pnpm run test`, which fails
+* OPEN. Benign globals are still parsed as globals (EV-08/09: `git --no-pager push` still has subcommand `push`);
+* a policy that wants to permit one lists it in `flags.allow`.
+*/
+function matchesStructurally(rule, parsed) {
+	const tokens = [...parsed.subcommand, ...parsed.positionals];
+	const required = rule.subcommand ?? [];
+	if (required.length > tokens.length) return false;
+	if (!required.every((token, index) => token === tokens[index])) return false;
+	return flagsMatch([...parsed.globals, ...parsed.flags], rule) && positionalsMatch(tokens.slice(required.length), rule.positionals);
+}
+/**
+* The D9 subcommand of a `git` call, if it is one of the denied ones (ADR-0007 item 2).
+*
+* With a structural parse in hand the subcommand is exact, and the profile has already denied every value-taking
+* re-targeting global. Without one — a caller passed `profiles` without git — nothing can tell a subcommand from a
+* global option's VALUE (`git --super-prefix x commit`), so every token is held against the set: conservative in
+* the only safe direction for an invariant that must not be switchable off.
+*/
+function deniedGitSubcommand(parsed, rest) {
+	const denied = AGENT_GIT_DENIED_SUBCOMMANDS;
+	if (parsed === void 0) return rest.find((token) => denied.includes(token));
+	const subcommand = parsed.subcommand[0];
+	return subcommand !== void 0 && denied.includes(subcommand) ? subcommand : void 0;
+}
+function branchAllows(rule, branch) {
+	return (rule.when?.branch ?? "any") === "any" || branch.kind === "branch" && !branch.protected;
+}
+function whenMatches(rule, context, branch) {
+	if (!branchAllows(rule, branch)) return false;
+	if (rule.when?.roles && !rule.when.roles.includes(context.role)) return false;
+	if (rule.when?.phases && !rule.when.phases.includes(context.phase)) return false;
+	return true;
+}
+const DECISION_RANK = {
+	deny: 0,
+	ask: 1,
+	allow: 2
+};
+/** deny beats ask beats allow (DESIGN 2.6.4 step 5, 2.6.2 precedence). `matches` must be non-empty. */
+function pickWinner(matches) {
+	return matches.reduce((best, rule) => DECISION_RANK[rule.decision] < DECISION_RANK[best.decision] ? rule : best);
+}
+/** Every rule of `program`, structurally or exactly matching, whose `when` is satisfied. Records every rule id it
+* looked at in `evaluatedRules`, matched or not (`PolicyVerdict.evaluatedRules`, "for `cohorte policy explain`"). */
+function matchRules(rules, program, rest, parsed, context, branch, evaluatedRules) {
+	const matches = [];
+	for (const rule of rules) {
+		if (rule.program !== program) continue;
+		evaluatedRules.push(rule.id);
+		const structurallyOk = parsed !== void 0 && matchesStructurally(rule, parsed);
+		const exactlyOk = matchesExactArgv(rule, rest);
+		if ((structurallyOk || exactlyOk) && whenMatches(rule, context, branch)) matches.push(rule);
+	}
+	return matches;
+}
+function denyEval(args) {
+	const { ruleId, code, reason, overridable, securityViolation, evaluatedRules } = args;
+	return {
+		decision: "deny",
+		ruleId,
+		reason,
+		overridable,
+		securityViolation,
+		evaluatedRules,
+		...code === void 0 ? {} : { code }
+	};
+}
+function applyRule(rule, args) {
+	const { resolvedFile, rest, context, timeoutMs, evaluatedRules } = args;
+	const overridable = rule.origin !== "builtin";
+	if (rule.decision === "deny") return denyEval({
+		ruleId: rule.id,
+		code: "permission/command-not-allowed",
+		reason: `denied by rule ${rule.id}`,
+		overridable,
+		securityViolation: false,
+		evaluatedRules
+	});
+	if (rule.network && context.sandboxLevel === "L0-process") return denyEval({
+		ruleId: rule.id,
+		code: "permission/network-denied",
+		reason: `rule ${rule.id} needs network access, which the L0 process sandbox cannot enforce a deny for`,
+		overridable: false,
+		securityViolation: false,
+		evaluatedRules
+	});
+	const command = {
+		file: resolvedFile,
+		args: [...rest],
+		cwd: context.cwd,
+		ruleId: rule.id,
+		replay: rule.replay,
+		network: rule.network,
+		timeoutMs: timeoutMs ?? context.defaultTimeoutMs
+	};
+	return {
+		decision: rule.decision === "ask" ? "ask" : "allow",
+		ruleId: rule.id,
+		reason: rule.decision === "ask" ? `rule ${rule.id} requires confirmation` : `allowed by rule ${rule.id}`,
+		overridable: true,
+		securityViolation: false,
+		evaluatedRules,
+		command
+	};
+}
+function createCommandPolicy(options) {
+	const profiles = options.profiles ?? BUILTIN_PROFILES;
+	return { evaluate(request, policy, context) {
+		const evaluatedRules = [];
+		const argv = request.argv;
+		const bareName = argv[0];
+		if (bareName === void 0 || bareName === "") return denyEval({
+			ruleId: "builtin/argv-empty",
+			code: "permission/command-not-allowed",
+			reason: "argv is empty: there is no program to run",
+			overridable: false,
+			securityViolation: true,
+			evaluatedRules
+		});
+		if (bareName.includes("/") || bareName.includes("\\")) return denyEval({
+			ruleId: "builtin/bare-name",
+			code: "permission/command-not-allowed",
+			reason: `argv[0] "${bareName}" is not a bare program name (DESIGN 2.6.4 step 1)`,
+			overridable: false,
+			securityViolation: true,
+			evaluatedRules
+		});
+		evaluatedRules.push("builtin/resolve");
+		const resolvedFile = options.programs.resolve(bareName);
+		if (resolvedFile === void 0) return denyEval({
+			ruleId: "builtin/resolve",
+			code: "permission/command-not-allowed",
+			reason: `"${bareName}" does not resolve to a program on the PATH pinned at run start`,
+			overridable: true,
+			securityViolation: false,
+			evaluatedRules
+		});
+		evaluatedRules.push("builtin/cwd-containment");
+		if (!isContainedIn(context.cwd, context.worktree)) return denyEval({
+			ruleId: "builtin/cwd-containment",
+			code: "permission/command-not-allowed",
+			reason: `cwd "${context.cwd}" is outside the agent's own worktree "${context.worktree}"`,
+			overridable: false,
+			securityViolation: true,
+			evaluatedRules
+		});
+		const branch = options.branches.branchOf(context.cwd);
+		const match = findProfile(bareName, profiles);
+		const canonicalName = match?.profile.program ?? bareName;
+		const rest = argv.slice(1);
+		evaluatedRules.push("builtin/trampolines");
+		if (isTrampoline(bareName) || isTrampoline(canonicalName)) {
+			const matches = matchRules(policy.rules, canonicalName, rest, void 0, context, branch, evaluatedRules);
+			const winner = matches.length > 0 ? pickWinner(matches) : void 0;
+			if (winner !== void 0) {
+				const evaluation = applyRule(winner.decision === "deny" ? winner : {
+					...winner,
+					decision: "ask"
+				}, {
+					resolvedFile,
+					rest,
+					context,
+					timeoutMs: request.timeoutMs,
+					evaluatedRules
+				});
+				if (evaluation.decision !== "ask") return evaluation;
+				return {
+					...evaluation,
+					reason: `"${bareName}" launches another program on behalf of the agent: rule ${winner.id} matches, but every use of a trampoline is \`ask\` (ADR-0024)`
+				};
+			}
+			return denyEval({
+				ruleId: "builtin/trampolines",
+				code: "security/command-trampoline",
+				reason: `"${bareName}" would launch another program on behalf of the agent`,
+				overridable: false,
+				securityViolation: true,
+				evaluatedRules
+			});
+		}
+		let parsed;
+		if (match !== void 0) {
+			evaluatedRules.push("builtin/profile-parse");
+			const outcome = match.profile.parse([...match.prefix, ...rest]);
+			if (outcome.kind === "denied") return denyEval({
+				ruleId: "builtin/global-option",
+				code: outcome.code,
+				reason: outcome.reason,
+				overridable: false,
+				securityViolation: true,
+				evaluatedRules
+			});
+			parsed = outcome;
+		}
+		if (canonicalName === "git") {
+			const subcommand = deniedGitSubcommand(parsed, rest);
+			if (subcommand !== void 0) {
+				evaluatedRules.push("builtin/agent-git-deny");
+				return denyEval({
+					ruleId: "builtin/agent-git-deny",
+					code: "permission/command-not-allowed",
+					reason: `agents may not run \`git ${subcommand}\`: Cohorte creates every commit (ADR-0007)`,
+					overridable: false,
+					securityViolation: true,
+					evaluatedRules
+				});
+			}
+		}
+		const matches = matchRules(policy.rules, canonicalName, rest, parsed, context, branch, evaluatedRules);
+		if (matches.length === 0) return denyEval({
+			ruleId: "builtin/no-rule",
+			code: "permission/command-not-allowed",
+			reason: `no command rule matches "${[bareName, ...rest].join(" ")}"; the default is deny`,
+			overridable: true,
+			securityViolation: false,
+			evaluatedRules
+		});
+		return applyRule(pickWinner(matches), {
+			resolvedFile,
+			rest,
+			context,
+			timeoutMs: request.timeoutMs,
+			evaluatedRules
+		});
+	} };
+}
+const closed = { additionalProperties: false };
+Type.Object({
+	decision: Type.Union([
+		Type.Literal("allow"),
+		Type.Literal("ask"),
+		Type.Literal("deny")
+	]),
+	ruleId: Type.String({ minLength: 1 }),
+	code: Type.Optional(Type.String({ minLength: 1 })),
+	reason: Type.String(),
+	overridable: Type.Boolean(),
+	securityViolation: Type.Boolean(),
+	evaluatedRules: Type.Array(Type.String()),
+	command: Type.Optional(Type.Object({
+		file: Type.String({ minLength: 1 }),
+		args: Type.Array(Type.String()),
+		cwd: Type.String({ minLength: 1 }),
+		ruleId: Type.String({ minLength: 1 }),
+		replay: Type.Union([Type.Literal("idempotent"), Type.Literal("at-most-once")]),
+		network: Type.Boolean(),
+		timeoutMs: Type.Integer({ minimum: 0 })
+	}, closed))
+}, closed);
+//#endregion
+//#region ../../packages/security/src/decide/gate/index.ts
+const deny = (stage, ruleId, reason, code = "permission/tool-not-granted", securityViolation = false) => ({
+	decision: "deny",
+	stage,
+	ruleId,
+	reason: `${code}: ${reason}`,
+	modelFacingReason: `${reason}. Do not retry.`,
+	overridable: !securityViolation,
+	securityViolation,
+	asks: [],
+	evaluatedRules: [ruleId],
+	normalized: null
+});
+const invalidPolicy = (message) => {
+	throw new Error(`configuration/policy-invalid: ${message}`);
+};
+const cloneFreeze = (value) => {
+	if (value && typeof value === "object") {
+		Object.freeze(value);
+		for (const child of Object.values(value)) cloneFreeze(child);
+	}
+	return value;
+};
+function createPolicyEngine(options) {
+	if (!options?.tools || !options.globs || !options.commands) invalidPolicy("policy engine ports are incomplete");
+	return { evaluate(call, grant, policy, ports) {
+		try {
+			const schema = options.tools.schemaOf(call.tool);
+			if (schema === void 0) return deny("schema", "builtin/unknown-tool", `unknown tool "${call.tool}"`, "validation/tool-input", true);
+			if (!Compile(schema).Check(call.input)) return deny("schema", "builtin/tool-schema", `input for "${call.tool}" does not match its strict schema`, "validation/tool-input");
+			const evaluatedRules = ["builtin/tool-schema"];
+			if (!grant.tools.includes(call.tool)) return {
+				...deny("capability", "grant/tool-not-granted", `tool "${call.tool}" is not granted to this agent`),
+				evaluatedRules
+			};
+			const normalizedPaths = [];
+			const base = grant.roots.workspace ?? grant.roots.readOnly[0];
+			if (base === void 0) return deny("path", "grant/no-root", "the agent has no workspace or read-only root", "permission/path-outside-grant");
+			for (const arg of options.tools.pathArgsOf(call.tool, call.input)) {
+				const resolved = ports.paths.resolve(arg.value, base, arg.intent);
+				if (!resolved.ok) return deny("path", `path/${resolved.error.code}`, `path argument "${arg.arg}" was refused: ${resolved.error.detail}`, resolved.error.security ? `security/${resolved.error.code}` : "permission/path-outside-grant", resolved.error.security);
+				if (options.globs.isDenied(resolved.value.relative, grant, arg.intent === "read" || arg.intent === "list" ? "read" : "write")) return deny("path", "grant/deny-glob", `path argument "${arg.arg}" is denied by the grant`);
+				normalizedPaths.push({
+					arg: arg.arg,
+					resolved: resolved.value,
+					intent: arg.intent
+				});
+			}
+			let command;
+			if (call.tool === "network_request") return deny("network", "builtin/network-denied", "network requests are disabled in V3.0", "permission/network-denied");
+			if (call.tool === "run_command") {
+				const input = call.input;
+				const argv = Array.isArray(input.argv) && input.argv.every((v) => typeof v === "string") ? input.argv : [];
+				const cwd = typeof input.cwd === "string" ? input.cwd : "";
+				const cwdResult = ports.paths.resolve(cwd, base, "exec-cwd");
+				if (!cwdResult.ok) return deny("command", "command/cwd", "command cwd is outside the grant", "permission/command-not-allowed", true);
+				const evaluation = options.commands.evaluate({
+					argv,
+					cwd
+				}, grant.commands, {
+					worktree: grant.roots.workspace ?? cwdResult.value.root,
+					cwd: cwdResult.value.canonical,
+					role: grant.role,
+					phase: call.phase,
+					sandboxLevel: policy.sandboxLevel,
+					defaultTimeoutMs: grant.limits.perTool.run_command?.timeoutMs ?? 6e4
+				});
+				evaluatedRules.push(...evaluation.evaluatedRules);
+				if (evaluation.decision === "deny" || evaluation.command === void 0) return deny("command", evaluation.ruleId, evaluation.reason, evaluation.code, evaluation.securityViolation);
+				command = evaluation.command;
+			}
+			const limit = grant.limits.perTool[call.tool];
+			const levels = [
+				["run", call.runId],
+				["phase", call.phase],
+				["agent", call.agentId],
+				["tool", call.tool]
+			];
+			for (const [level, id] of levels) {
+				const remaining = ports.budgets.remaining(level, id);
+				if ((remaining.toolCalls ?? 1) <= 0 || (remaining.wallClockMs ?? 1) <= 0) return deny("budget", `budget/${level}`, `${level} budget is exhausted`, "budget/exhausted");
+			}
+			if (ports.budgets.callsInLastMinute(call.agentId, call.tool) >= grant.limits.maxCallsPerMinute) return deny("budget", "budget/rate-limit", "tool rate limit is exhausted", "budget/rate-limit");
+			const timeoutMs = Math.max(1, Math.min(limit?.timeoutMs ?? 6e4, command?.timeoutMs ?? Number.MAX_SAFE_INTEGER, ports.budgets.remaining("agent", call.agentId).wallClockMs ?? Number.MAX_SAFE_INTEGER));
+			return {
+				decision: "allow",
+				stage: "budget",
+				ruleId: command?.ruleId ?? "grant/tool",
+				reason: "allowed by the policy",
+				modelFacingReason: "",
+				overridable: true,
+				securityViolation: false,
+				asks: [],
+				evaluatedRules,
+				normalized: {
+					tool: call.tool,
+					paths: normalizedPaths,
+					...command ? { command: {
+						...command,
+						timeoutMs
+					} } : {},
+					input: call.input,
+					grantKeyMaterial: {
+						tool: call.tool,
+						input: call.input
+					}
+				}
+			};
+		} catch (error) {
+			return deny("schema", "security/gate-internal-error", error instanceof Error ? error.message : "gate failed closed", "security/gate-internal-error", true);
+		}
+	} };
+}
+/** Missing, unparseable or empty policy => `configuration/policy-invalid`: no tool ever executes. */
+function buildPolicySnapshot(config, ownership, options) {
+	if (!config || config.policy === void 0 || !ownership || options?.sandboxLevel === void 0) invalidPolicy("missing policy or ownership");
+	const commands = [
+		...config.policy.commands.deny,
+		...config.policy.commands.ask,
+		...config.policy.commands.allow,
+		...config.policy.dangerousCommands
+	];
+	if (commands.some((rule) => rule.origin !== "project-config" && rule.origin !== "project-checks")) invalidPolicy("policy command origin is invalid");
+	const snapshot = {
+		commands: Object.freeze({
+			default: "deny",
+			rules: commands.map((rule) => ({ ...rule }))
+		}),
+		symlinks: { ...config.policy.symlinks },
+		network: { ...DEFAULT_NETWORK_POLICY },
+		protectedBranches: [...config.project.protectedBranches],
+		ownership: cloneFreeze(structuredClone(ownership)),
+		sandboxLevel: options.sandboxLevel
+	};
+	return Object.freeze({
+		...snapshot,
+		digest: sha256Hex(canonicalJson(snapshot))
+	});
+}
+/** `cohorte policy explain -- <argv…>`: stages 1-5, offline, nothing executes. */
+function explainPolicy(engine, call, grant, policy, ports) {
+	if (!engine || !call || !grant || !policy || !ports) invalidPolicy("policy explain requires a complete call, grant, snapshot and ports");
+	return engine.evaluate(call, grant, policy, ports);
+}
+//#endregion
+//#region ../../packages/security/src/decide/paths/glob.ts
+/** Locked once, here: deny sets and allow sets alike are matched with the SAME options. */
+const PICOMATCH_OPTIONS = {
+	dot: true,
+	nocase: false
+};
+const NEVER = () => false;
+function normalizePattern(pattern) {
+	return pattern.includes("/") ? pattern : `**/${pattern}`;
+}
+const PATTERN_CACHE_LIMIT = 512;
+const patternCache = /* @__PURE__ */ new Map();
+const globSetCache = /* @__PURE__ */ new WeakMap();
+function cacheKey(patterns) {
+	return patterns.join("\0");
+}
+function memoize(key, compile) {
+	const cached = patternCache.get(key);
+	if (cached !== void 0) return cached;
+	const compiled = compile();
+	if (patternCache.size >= PATTERN_CACHE_LIMIT) patternCache.clear();
+	patternCache.set(key, compiled);
+	return compiled;
+}
+/**
+* Compiled once per pattern list and memoized, so every consumer of this module shares the exact same semantics
+* at the same cost. An empty pattern list matches nothing (picomatch(`[]`) would otherwise match everything).
+*/
+function compilePatterns(patterns) {
+	if (patterns.length === 0) return NEVER;
+	return memoize(`p
${cacheKey(patterns)}`, () => picomatch(patterns.map(normalizePattern), PICOMATCH_OPTIONS));
+}
+function compileGlobSet(set) {
+	const cached = globSetCache.get(set);
+	if (cached !== void 0) return cached;
+	const compiled = memoize(`s
${cacheKey(set.include)}${cacheKey(set.exclude)}`, () => {
+		const included = compilePatterns(set.include);
+		if (set.exclude.length === 0) return included;
+		const excluded = compilePatterns(set.exclude);
+		return (relativePosixPath) => included(relativePosixPath) && !excluded(relativePosixPath);
+	});
+	globSetCache.set(set, compiled);
+	return compiled;
+}
+/**
+* Neither dialect can express a RE-INCLUDE, so `toExcludeArgs` renders the exclusions alone:
+*
+* - `rg --glob` reads its list in order, later entries overriding earlier matches — but a POSITIVE glob turns
+*   ripgrep's override set into a whitelist (the `ignore` crate ignores every file that matches no positive
+*   glob), which would silently empty the listing. Unprovable on this machine anyway (PLAN F-1: no `rg`).
+* - git pathspec is NOT order-dependent: `:(exclude,…)` magic is subtractive and applied AFTER the union of
+*   every positive pathspec. A rendered `:(glob)<re-include>` therefore cannot bring back what the exclusion
+*   removed, and when the caller passes no positive pathspec of its own it narrows the enumeration to the
+*   re-include, which the exclusion then empties: `git ls-files`/`git grep` return NOTHING, exit 0 (measured).
+*
+* The consequence is deliberate and fail-closed (I2): for a deny set with a non-empty `exclude` the external
+* enumerator drops MORE than the matcher denies — never less. `matches()` / `isDenied` stay the authority, and
+* a caller that needs the re-included paths in its output must enumerate without the args and post-filter.
+*/
+function toExcludePatterns(set) {
+	return set.include.map(normalizePattern);
+}
+function createGlobMatcher() {
+	function deniedBySet(relativePosixPath, grant, intent) {
+		return compileGlobSet(intent === "read" ? grant.denyRead : grant.denyWrite)(relativePosixPath);
+	}
+	return {
+		matches(relativePosixPath, set) {
+			return compileGlobSet(set)(relativePosixPath);
+		},
+		/**
+		* "Not permitted for this intent" — the whole of step 7 in one call, which is why the contract takes an
+		* `AgentGrant` and not a `GlobSet`: the deny set wins over the allow set, and a path that no allow pattern
+		* matches is denied too (fail closed, I2). That second half is what keeps the I11 ownership boundary in tool
+		* OUTPUT filtering (`search`, `list_files`, `git_diff`), where the gate's own allow stage never runs.
+		*
+		* The empty relative path is the WORKSPACE ROOT itself — what `resolve('.', root, 'list')` returns — and no
+		* picomatch pattern matches the empty string, `**` and `**​/*` included. The root is not "outside the
+		* surface": it IS the surface, so an allow set that has any pattern at all covers it, and only a deny
+		* pattern (or a grant that permits nothing for this intent) can forbid it.
+		*/
+		isDenied(relativePosixPath, grant, intent) {
+			if (deniedBySet(relativePosixPath, grant, intent)) return true;
+			const allowSet = intent === "read" ? grant.read : grant.write;
+			if (relativePosixPath === "") return allowSet.include.length === 0;
+			return !compileGlobSet(allowSet)(relativePosixPath);
+		},
+		toExcludeArgs(set, dialect) {
+			const patterns = toExcludePatterns(set);
+			return dialect === "rg-glob" ? patterns.map((pattern) => `!${pattern}`) : patterns.map((pattern) => `:(exclude,glob)${pattern}`);
+		}
+	};
+}
+//#endregion
+//#region ../../packages/security/src/decide/paths/resolve.ts
+const MAX_INPUT_LENGTH = 4096;
+const CONTROL_OR_NUL = /[\x00-\x1f\x7f]/;
+const ENV_SYNTAX = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|%[A-Za-z_][A-Za-z0-9_]*%/;
+const HOME_SHORTHAND_SEGMENT = /^~([A-Za-z0-9_][A-Za-z0-9_-]*)?$/;
+const WINDOWS_DRIVE = /^[A-Za-z]:[\\/]/;
+const UNC_PREFIX = /^\\\\/;
+const WRITE_LIKE = /* @__PURE__ */ new Set(["write", "create"]);
+function describeError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function violation(code, security, detail) {
+	return err({
+		code,
+		security,
+		detail
+	});
+}
+function segmentsOf(absolutePosixPath) {
+	return absolutePosixPath.split("/").filter((part) => part.length > 0);
+}
+/** Containment by path SEGMENTS, never `startsWith`: `apps/api` must not contain `apps/api-gateway`. */
+function segmentsContain(longer, shorter) {
+	if (longer.length < shorter.length) return false;
+	for (let index = 0; index < shorter.length; index += 1) if (longer[index] !== shorter[index]) return false;
+	return true;
+}
+function findRoot(absolutePosixPath, roots) {
+	const target = segmentsOf(absolutePosixPath);
+	return roots.find((root) => segmentsContain(target, segmentsOf(root)));
+}
+function isWithinAny(absolutePosixPath, candidates) {
+	const target = segmentsOf(absolutePosixPath);
+	return candidates.some((candidate) => segmentsContain(target, segmentsOf(candidate)));
+}
+/**
+* POSIX-relative form of `absolutePosixPath` to `root`, which always CONTAINS it: the caller picks `root` with
+* `findRoot` on the CANONICAL path. It can therefore never climb with `..` — and it must not, because the deny
+* globs and the protected-repository patterns are matched against this string, and a `..` segment matches no
+* double-star pattern (a relative form with `..` silently disabled both layers).
+*/
+function relativeTo(root, absolutePosixPath) {
+	return segmentsOf(absolutePosixPath).slice(segmentsOf(root).length).join("/");
+}
+function isErrnoException(error) {
+	return error instanceof Error && "code" in error;
+}
+/** `null` for "does not exist" (ENOENT — or ENOTDIR, an ancestor turned out not to be a directory). */
+function lstatOrNull(absolutePath) {
+	try {
+		return lstatSync(absolutePath);
+	} catch (error) {
+		if (isErrnoException(error) && (error.code === "ENOENT" || error.code === "ENOTDIR")) return null;
+		throw error;
+	}
+}
+function isSpecialFile(stat) {
+	return stat.isFIFO() || stat.isSocket() || stat.isBlockDevice() || stat.isCharacterDevice();
+}
+/**
+* The one point a blind create could alias an existing entry that `realpath` cannot fix for us, because the
+* requested name does not exist yet: a case-insensitive volume already holds a differently-cased sibling.
+*/
+function caseInsensitiveSiblingExists(dir, requestedName) {
+	let entries;
+	try {
+		entries = readdirSync(dir);
+	} catch {
+		return false;
+	}
+	const lower = requestedName.toLowerCase();
+	return entries.some((entry) => entry !== requestedName && entry.toLowerCase() === lower);
+}
+function createPathResolver(options) {
+	const roots = options.roots.map((root) => root);
+	const protectedRoots = options.protectedRoots.map((root) => root);
+	const protectedRepoPath = compilePatterns(PROTECTED_REPO_GLOBS);
+	const { mode: symlinkMode, hardlinksOnWrite } = options.symlinks;
+	/** DESIGN 2.6.3 steps 3-4: one component at a time, from `root` to the leaf. */
+	function walk(root, target, intent) {
+		const remaining = segmentsOf(target).slice(segmentsOf(root).length);
+		let current = root;
+		let viaSymlink = false;
+		for (let index = 0; index < remaining.length; index += 1) {
+			const name = remaining[index];
+			if (name === void 0) break;
+			const candidate = `${current}/${name}`;
+			const isFinal = index === remaining.length - 1;
+			const stat = lstatOrNull(candidate);
+			if (stat === null) {
+				const canonicalDir = realpathSync.native(current);
+				if (WRITE_LIKE.has(intent) && caseInsensitiveSiblingExists(canonicalDir, name)) return violation("case-collision", true, `${candidate} collides, case-insensitively, with an existing entry of ${canonicalDir}`);
+				return ok({
+					canonicalDir,
+					tailSegments: remaining.slice(index),
+					exists: false,
+					viaSymlink
+				});
+			}
+			if (stat.isSymbolicLink()) {
+				if (isFinal && WRITE_LIKE.has(intent)) return violation("symlink-final-write", true, `${candidate} is a symlink; a write never follows the final path component`);
+				if (symlinkMode === "deny-all") return violation("symlink-denied", true, `${candidate} is a symlink; policy is deny-all`);
+				let linkTarget;
+				try {
+					linkTarget = realpathSync.native(candidate);
+				} catch (error) {
+					return violation("symlink-escape", true, `${candidate} could not be resolved: ${describeError(error)}`);
+				}
+				if (symlinkMode === "deny-outgoing" && findRoot(linkTarget, roots) === void 0) return violation("symlink-escape", true, `${candidate} -> ${linkTarget} leaves every root`);
+				current = linkTarget;
+				viaSymlink = true;
+				continue;
+			}
+			if (isSpecialFile(stat) && !isFinal) return violation("special-file", true, `${candidate} is a FIFO, socket or device: cannot descend into it`);
+			current = candidate;
+		}
+		return ok({
+			canonicalDir: realpathSync.native(current),
+			tailSegments: [],
+			exists: true,
+			viaSymlink
+		});
+	}
+	function resolveOnce(input, base, intent) {
+		if (CONTROL_OR_NUL.test(input)) return violation("nul-byte", true, "control character or NUL byte in path");
+		if (Buffer.byteLength(input, "utf8") > MAX_INPUT_LENGTH) return violation("too-long", true, `path exceeds ${MAX_INPUT_LENGTH} bytes`);
+		if (input.split("/").some((segment) => HOME_SHORTHAND_SEGMENT.test(segment))) return violation("outside-roots", true, "home-directory shorthand (~) is never expanded");
+		if (ENV_SYNTAX.test(input)) return violation("outside-roots", true, "environment-variable syntax is never expanded");
+		if (WINDOWS_DRIVE.test(input) || UNC_PREFIX.test(input)) return violation("outside-roots", true, "Windows drive/UNC path forms are not supported");
+		const target = resolve(base, input.normalize("NFC"));
+		const lexicalRoot = findRoot(target, roots);
+		if (lexicalRoot === void 0) return violation("outside-roots", true, `${target} is outside every root`);
+		const walked = walk(lexicalRoot, target, intent);
+		if (!walked.ok) return walked;
+		const { canonicalDir, tailSegments, exists, viaSymlink } = walked.value;
+		const canonical = tailSegments.length === 0 ? canonicalDir : `${canonicalDir}/${tailSegments.join("/")}`;
+		const root = findRoot(canonical, roots);
+		if (root === void 0) return violation("outside-roots", true, `${canonical} resolves outside every root`);
+		if (isWithinAny(canonical, protectedRoots)) return violation("protected-root", true, `${canonical} is a protected root`);
+		const relative = relativeTo(root, canonical);
+		if (protectedRepoPath(relative)) return violation("protected-root", true, `${relative} is a protected repository path`);
+		let identity;
+		if (exists) {
+			const stat = lstatSync(canonical);
+			if (isSpecialFile(stat)) return violation("special-file", true, `${canonical} is a FIFO, socket or device`);
+			if (WRITE_LIKE.has(intent) && stat.isFile() && stat.nlink > 1 && hardlinksOnWrite === "deny") return violation("hardlink-multiply-linked", true, `${canonical} has ${stat.nlink} hard links`);
+			identity = {
+				dev: stat.dev,
+				ino: stat.ino,
+				nlink: stat.nlink
+			};
+		}
+		return ok({
+			canonical,
+			relative,
+			root,
+			exists,
+			viaSymlink,
+			...identity ? { identity } : {}
+		});
+	}
+	return { resolve(input, base, intent) {
+		try {
+			return resolveOnce(input, base, intent);
+		} catch (error) {
+			return violation("outside-roots", true, `unexpected error resolving ${JSON.stringify(input)}: ${describeError(error)}`);
+		}
+	} };
+}
+//#endregion
+//#region ../../packages/tools/src/catalogue/schemas.ts
+const ReadFileInput = Type.Object({
+	path: Type.String(),
+	offset: Type.Optional(Type.Integer({ minimum: 0 })),
+	limit: Type.Optional(Type.Integer({ minimum: 1 }))
+});
+const ListFilesInput = Type.Object({
+	path: Type.Optional(Type.String()),
+	glob: Type.Optional(Type.String()),
+	maxEntries: Type.Optional(Type.Integer({ minimum: 1 }))
+});
+const SearchInput = Type.Object({
+	pattern: Type.String(),
+	path: Type.Optional(Type.String()),
+	glob: Type.Optional(Type.String()),
+	caseInsensitive: Type.Optional(Type.Boolean()),
+	maxMatches: Type.Optional(Type.Integer({ minimum: 1 }))
+});
+const WriteFileInput = Type.Object({
+	path: Type.String(),
+	content: Type.String()
+});
+const PatchFileInput = Type.Object({
+	path: Type.String(),
+	edits: Type.Array(Type.Object({
+		oldText: Type.String(),
+		newText: Type.String()
+	}), { minItems: 1 })
+});
+const RunCommandInput = Type.Object({
+	argv: Type.Array(Type.String(), { minItems: 1 }),
+	cwd: Type.Optional(Type.String()),
+	timeoutMs: Type.Optional(Type.Integer({ minimum: 1 }))
+});
+const GitDiffInput = Type.Object({
+	base: Type.Optional(ClosedEnum([
+		"run-base",
+		"integration",
+		"checkpoint"
+	])),
+	paths: Type.Optional(Type.Array(Type.String())),
+	stat: Type.Optional(Type.Boolean())
+});
+const ApprovalRequestInput = Type.Object({
+	question: Type.String(),
+	options: Type.Optional(Type.Array(Type.String()))
+});
+const GitCommitInput = Type.Object({ message: Type.String() });
+const NetworkRequestInput = Type.Object({
+	url: Type.String(),
+	method: Type.Optional(Type.String())
+});
+const SecretReadInput = Type.Object({ id: Type.String() });
+const noPaths = () => [];
+const stringField = (input, key) => {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const value = input[key];
+	return typeof value === "string" ? value : void 0;
+};
+const arrayField = (input, key) => {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const value = input[key];
+	return Array.isArray(value) ? value : void 0;
+};
+/** DESIGN 2.7, in table order. `submit_result.inputSchema` is `AgentOutput` itself — closed by the same
+* `toStrictSchema` every other row goes through in `./index.ts`, so the two are deep-equal by construction. */
+const CATALOGUE_ROWS = [
+	{
+		name: "read_file",
+		description: "Read a file as sealed text with line numbers. offset/limit page through it; binary files error; capped at 256 KiB per call.",
+		inputSchema: ReadFileInput,
+		effect: "read",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const path = stringField(input, "path");
+			return path === void 0 ? [] : [{
+				arg: "path",
+				value: path,
+				intent: "read"
+			}];
+		}
+	},
+	{
+		name: "list_files",
+		description: "List files under a path (default the workspace root), filtered by glob. Deny sets are filtered out; outgoing symlinks are never followed.",
+		inputSchema: ListFilesInput,
+		effect: "read",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const path = stringField(input, "path");
+			return path === void 0 ? [] : [{
+				arg: "path",
+				value: path,
+				intent: "list"
+			}];
+		}
+	},
+	{
+		name: "search",
+		description: "Search file contents for a pattern (a literal argv element, never a shell string). Every hit is filtered against the deny sets and the grant before it is returned.",
+		inputSchema: SearchInput,
+		effect: "read",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const path = stringField(input, "path");
+			return path === void 0 ? [] : [{
+				arg: "path",
+				value: path,
+				intent: "list"
+			}];
+		}
+	},
+	{
+		name: "write_file",
+		description: "Write the complete content of a file, creating it if it does not exist. The whole file is replaced.",
+		inputSchema: WriteFileInput,
+		effect: "write",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const path = stringField(input, "path");
+			return path === void 0 ? [] : [{
+				arg: "path",
+				value: path,
+				intent: "write"
+			}];
+		}
+	},
+	{
+		name: "patch_file",
+		description: "Apply exact-match text edits to a file: each oldText must occur exactly once in the current content, or the call fails without writing anything.",
+		inputSchema: PatchFileInput,
+		effect: "write",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const path = stringField(input, "path");
+			return path === void 0 ? [] : [{
+				arg: "path",
+				value: path,
+				intent: "write"
+			}];
+		}
+	},
+	{
+		name: "run_command",
+		description: "Run one allow-listed command (argv only, never a shell line) and return its output.",
+		inputSchema: RunCommandInput,
+		effect: "execute",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const cwd = stringField(input, "cwd");
+			return cwd === void 0 ? [] : [{
+				arg: "cwd",
+				value: cwd,
+				intent: "exec-cwd"
+			}];
+		}
+	},
+	{
+		name: "git_diff",
+		description: "Show a diff of the worktree against 'run-base' (the run's pinned base, the default on a read-only review ref), 'integration' (the default in a slot) or 'checkpoint'.",
+		inputSchema: GitDiffInput,
+		effect: "read",
+		terminal: false,
+		pathArgsOf: (input) => {
+			const paths = arrayField(input, "paths");
+			if (!paths) return [];
+			const out = [];
+			paths.forEach((value, index) => {
+				if (typeof value === "string") out.push({
+					arg: `paths[${index}]`,
+					value,
+					intent: "read"
+				});
+			});
+			return out;
+		}
+	},
+	{
+		name: "approval_request",
+		description: "Ask a human a question before proceeding, optionally offering a fixed set of answers. Waits for a decision.",
+		inputSchema: ApprovalRequestInput,
+		effect: "control",
+		terminal: false,
+		pathArgsOf: noPaths
+	},
+	{
+		name: "submit_result",
+		description: "Submit the final structured result for this task. Call submit_result alone, last: no other tool call may follow it in the same batch.",
+		inputSchema: AgentOutput,
+		effect: "control",
+		terminal: true,
+		pathArgsOf: (input) => {
+			const artifacts = arrayField(input, "artifacts");
+			if (!artifacts) return [];
+			const out = [];
+			artifacts.forEach((artifact, index) => {
+				const path = stringField(artifact, "path");
+				if (path !== void 0) out.push({
+					arg: `artifacts[${index}].path`,
+					value: path,
+					intent: "read"
+				});
+			});
+			return out;
+		}
+	},
+	{
+		name: "git_commit",
+		description: "Reserved: granted to nobody in V3.0. Cohorte alone commits agent work.",
+		inputSchema: GitCommitInput,
+		effect: "write",
+		terminal: false,
+		pathArgsOf: noPaths
+	},
+	{
+		name: "network_request",
+		description: "Reserved: granted to nobody in V3.0. Agents have no network access.",
+		inputSchema: NetworkRequestInput,
+		effect: "network",
+		terminal: false,
+		pathArgsOf: noPaths
+	},
+	{
+		name: "secret_read",
+		description: "Reserved: granted to nobody in V3.0.",
+		inputSchema: SecretReadInput,
+		effect: "read",
+		terminal: false,
+		pathArgsOf: noPaths
+	}
+];
+CATALOGUE_ROWS.map((row) => row.name);
+//#endregion
+//#region ../../packages/tools/src/impl/exec/index.ts
+const metadata$1 = CATALOGUE_ROWS.find((row) => row.name === "run_command");
+if (!metadata$1) throw new Error("missing catalogue row: run_command");
+const fail$2 = (code, message) => {
+	throw new Error(`${code}: ${message}`);
+};
+const runCommand = {
+	...metadata$1,
+	plan(input, n) {
+		return {
+			kind: "tool.run_command",
+			replayClass: n.command?.replay ?? "at-most-once",
+			verify: {
+				tool: "run_command",
+				input,
+				normalized: JSON.parse(JSON.stringify(n))
+			}
+		};
+	},
+	async execute(input, n, ctx, signal) {
+		if (signal.aborted) fail$2("tool-transient/cancelled", "command was cancelled");
+		const command = n.command ?? fail$2("permission/command-not-allowed", "run_command has no normalized command");
+		const value = input;
+		const result = await ctx.executor.run({
+			file: command.file,
+			args: command.args,
+			cwd: command.cwd,
+			env: {},
+			fs: {
+				readWrite: [ctx.workspaceRoot],
+				readOnly: [],
+				denyRead: []
+			},
+			network: "none",
+			timeoutMs: value.timeoutMs ?? command.timeoutMs,
+			maxOutputBytes: 1048576,
+			stdin: "ignore",
+			limits: {},
+			require: "best-effort"
+		}, signal);
+		const text = String(result.tail);
+		return {
+			output: {
+				argv: value.argv,
+				exitCode: result.exitCode,
+				...result.signal === void 0 ? {} : { signal: result.signal },
+				outcome: result.outcome,
+				text,
+				outputSha256: result.outputSha256,
+				outputBytes: result.outputBytes,
+				truncated: result.truncated
+			},
+			modelText: text,
+			filesTouched: []
+		};
+	},
+	verifyAfterCrash: async (_record) => "in-doubt",
+	describeForNote: (record) => `run_command ${record.idempotencyKey}`
+};
+const EXEC_TOOLS = Object.freeze({ run_command: runCommand });
+//#endregion
+//#region ../../packages/tools/src/impl/read/index.ts
+const row$1 = (name) => {
+	const entry = CATALOGUE_ROWS.find((candidate) => candidate.name === name);
+	if (entry === void 0) throw new Error(`missing catalogue row: ${name}`);
+	return entry;
+};
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const result$1 = (output, modelText) => ({
+	output,
+	modelText,
+	filesTouched: []
+});
+const fail$1 = (code, message) => {
+	throw new Error(`${code}: ${message}`);
+};
+const requiredPath$1 = (value, message) => value ?? fail$1("permission/path-outside-grant", message);
+const make$1 = (name, execute) => {
+	return {
+		...row$1(name),
+		plan: (input, n) => ({
+			kind: "tool.read",
+			replayClass: "idempotent",
+			verify: {
+				tool: name,
+				input,
+				normalized: JSON.parse(JSON.stringify(n))
+			}
+		}),
+		execute,
+		verifyAfterCrash: async (_record) => "done",
+		describeForNote: (record) => `${name} ${record.idempotencyKey}`
+	};
+};
+const readFileTool = make$1("read_file", async (input, n, _ctx, signal) => {
+	if (signal.aborted) fail$1("tool-transient/cancelled", "read was cancelled");
+	const target = requiredPath$1(n.paths[0]?.resolved.canonical, "read_file has no resolved path");
+	const bytes = await readFile(target);
+	if (bytes.byteLength > 262144) fail$1("tool-terminal/output-too-large", "file exceeds the 256 KiB read limit");
+	if (bytes.includes(0)) fail$1("tool-terminal/binary-file", "binary files are not returned as text");
+	const value = input;
+	const offset = value.offset ?? 0;
+	const selected = bytes.toString("utf8").split(/\r?\n/).slice(offset, value.limit === void 0 ? void 0 : offset + value.limit);
+	const text = selected.map((line, index) => `${offset + index + 1}: ${line}`).join("\n");
+	return result$1({
+		path: n.paths[0]?.resolved.relative ?? value.path,
+		text,
+		sha256: sha256(bytes),
+		offset,
+		lines: selected.length
+	}, text);
+});
+const walk = async (root, current, output, max) => {
+	if (output.length >= max) return;
+	for (const entry of await readdir(current, { withFileTypes: true })) {
+		if (entry.name === ".git" || entry.name === ".cohorte" || entry.name === ".pi" || entry.isSymbolicLink()) continue;
+		const absolute = join(current, entry.name);
+		if (entry.isDirectory()) await walk(root, absolute, output, max);
+		else output.push(relative(root, absolute).split("\\").join("/"));
+		if (output.length >= max) return;
+	}
+};
+const globMatch = (value, pattern) => {
+	if (!pattern || pattern === "**") return true;
+	const escaped = pattern.replace(/[.*+?^()|[\]\\]/g, "\\$&").replaceAll("\\*\\*", ".*").replaceAll("\\*", "[^/]*").replaceAll("\\?", "[^/]");
+	return new RegExp(`^${escaped}$`).test(value);
+};
+const listFilesTool = make$1("list_files", async (input, n, _ctx, signal) => {
+	if (signal.aborted) fail$1("tool-transient/cancelled", "listing was cancelled");
+	const root = requiredPath$1(n.paths[0]?.resolved.canonical, "list_files has no resolved root");
+	const value = input;
+	const files = [];
+	await walk(root, root, files, value.maxEntries ?? 1e3);
+	const filtered = files.filter((file) => globMatch(file, value.glob));
+	return result$1({
+		files: filtered,
+		truncated: files.length >= (value.maxEntries ?? 1e3)
+	}, filtered.join("\n"));
+});
+const searchTool = make$1("search", async (input, n, _ctx, signal) => {
+	if (signal.aborted) fail$1("tool-transient/cancelled", "search was cancelled");
+	const root = requiredPath$1(n.paths[0]?.resolved.canonical, "search has no resolved root");
+	const value = input;
+	const expression = new RegExp(value.pattern, value.caseInsensitive ? "i" : "");
+	const files = [];
+	await walk(root, root, files, 1e4);
+	const matches = [];
+	for (const file of files.filter((candidate) => globMatch(candidate, value.glob))) {
+		if (matches.length >= (value.maxMatches ?? 100)) break;
+		const text = await readFile(join(root, file), "utf8").catch(() => void 0);
+		if (text === void 0) continue;
+		text.split(/\r?\n/).forEach((line, index) => {
+			if (matches.length < (value.maxMatches ?? 100) && expression.test(line)) matches.push({
+				path: file,
+				line: index + 1,
+				text: line
+			});
+		});
+	}
+	return result$1({
+		matches,
+		filteredPaths: 0
+	}, matches.map((match) => `${match.path}:${match.line}:${match.text}`).join("\n"));
+});
+const gitDiffTool = make$1("git_diff", async (input, _n, ctx, signal) => {
+	if (signal.aborted) fail$1("tool-transient/cancelled", "diff was cancelled");
+	const value = input;
+	const output = await ctx.git.diffBySurface({
+		repo: ctx.workspaceRoot,
+		base: value.base ?? "integration",
+		head: "HEAD",
+		surfaces: { surfaceOf: () => "shared" }
+	});
+	const text = output.map((item) => new TextDecoder().decode(item.patch.bytes)).join("\\n");
+	return result$1({
+		base: value.base ?? "integration",
+		stat: value.stat ?? false,
+		files: output.flatMap((item) => item.files),
+		diff: text
+	}, text);
+});
+const READ_TOOLS = Object.freeze({
+	read_file: readFileTool,
+	list_files: listFilesTool,
+	search: searchTool,
+	git_diff: gitDiffTool
+});
+//#endregion
+//#region ../../packages/tools/src/catalogue/stub.ts
+const rowByName$1 = new Map(CATALOGUE_ROWS.map((row) => [row.name, row]));
+/**
+* Every deliverable of THIS unit (U0.08) ends here: a `ToolImplementation` whose `plan`/`execute`/`verifyAfterCrash`
+* /`describeForNote` throw. The metadata (`name`, `inputSchema`, `description`, `effect`, `terminal`) is real —
+* `impl/read`, `impl/write`, `impl/exec` and `impl/state` (Wave 2: `U2.03`, `U2.04`) call this for every tool they
+* do not yet implement, and REPLACE the body, never the metadata, one tool at a time.
+*/
+function stubImplementation(name) {
+	const row = rowByName$1.get(name);
+	if (!row) throw new RangeError(`stubImplementation: unknown tool ${JSON.stringify(name)}`);
+	const notImplemented = (member) => {
+		throw new NotImplemented(`tools/${name}.${member} (Wave 2 fills packages/tools/src/impl/**)`);
+	};
+	return {
+		name: row.name,
+		inputSchema: row.inputSchema,
+		description: row.description,
+		effect: row.effect,
+		terminal: row.terminal,
+		plan() {
+			return notImplemented("plan");
+		},
+		execute() {
+			return notImplemented("execute");
+		},
+		verifyAfterCrash() {
+			return notImplemented("verifyAfterCrash");
+		},
+		describeForNote() {
+			return notImplemented("describeForNote");
+		}
+	};
+}
+//#endregion
+//#region ../../packages/tools/src/impl/state/index.ts
+const metadata = (name) => {
+	const row = CATALOGUE_ROWS.find((candidate) => candidate.name === name);
+	if (row === void 0) throw new Error(`missing catalogue row: ${name}`);
+	return row;
+};
+const approvalRequest = {
+	...metadata("approval_request"),
+	plan: () => null,
+	execute: async (input, _normalized, ctx) => {
+		const value = input;
+		const decision = await ctx.requestApproval(value.question, value.options);
+		return {
+			output: decision,
+			modelText: decision.answer ?? decision.decision,
+			filesTouched: []
+		};
+	},
+	verifyAfterCrash: async () => "done",
+	describeForNote: () => "approval request"
+};
+const submitResult = {
+	...metadata("submit_result"),
+	plan: () => null,
+	execute: async (input, _normalized, ctx) => {
+		const accepted = await ctx.acceptResult(input);
+		if (!accepted.accepted) throw new Error(`validation/agent-output: ${accepted.reason ?? "result was rejected"}`);
+		return {
+			output: { accepted: true },
+			modelText: "result submitted",
+			filesTouched: []
+		};
+	},
+	verifyAfterCrash: async () => "done",
+	describeForNote: () => "submit result"
+};
+const STATE_TOOLS = Object.freeze({
+	approval_request: approvalRequest,
+	submit_result: submitResult,
+	git_commit: stubImplementation("git_commit"),
+	network_request: stubImplementation("network_request"),
+	secret_read: stubImplementation("secret_read")
+});
+//#endregion
+//#region ../../packages/tools/src/impl/write/index.ts
+const row = (name) => {
+	const entry = CATALOGUE_ROWS.find((candidate) => candidate.name === name);
+	if (entry === void 0) throw new Error(`missing catalogue row: ${name}`);
+	return entry;
+};
+const digest = (value) => sha256Hex(createHash("sha256").update(value).digest());
+const fail = (code, message) => {
+	throw new Error(`${code}: ${message}`);
+};
+const requiredPath = (n) => n.paths[0]?.resolved.canonical ?? fail("permission/path-outside-grant", "write tool has no resolved path");
+const result = (output, modelText, filesTouched) => ({
+	output,
+	modelText,
+	filesTouched
+});
+const make = (name, execute) => {
+	return {
+		...row(name),
+		plan: (input, _n) => ({
+			kind: name === "write_file" ? "tool.write_file" : "tool.patch_file",
+			replayClass: "verifiable",
+			verify: {
+				tool: name,
+				input
+			}
+		}),
+		execute,
+		verifyAfterCrash: async (record, ctx) => {
+			const request = record.request;
+			if (!request.path) return "in-doubt";
+			try {
+				const path = ctx.paths.resolve(request.path, ctx.workspaceRoot, "read");
+				if (!path.ok) return "in-doubt";
+				const bytes = await readFile(path.value.canonical);
+				return request.content !== void 0 && digest(bytes) === digest(request.content) ? "done" : "not-done";
+			} catch {
+				return "not-done";
+			}
+		},
+		describeForNote: (record) => `${name} ${record.idempotencyKey}`
+	};
+};
+const atomicWrite = async (target, content) => {
+	const temporary = join(dirname(target), `.cohorte-write-${process.pid}-${Date.now()}`);
+	await writeFile(temporary, content, {
+		encoding: "utf8",
+		flag: "wx"
+	});
+	await rename(temporary, target);
+};
+const writeFileTool = make("write_file", async (input, n, _ctx, signal) => {
+	if (signal.aborted) fail("tool-transient/cancelled", "write was cancelled");
+	const target = requiredPath(n);
+	const value = input;
+	let before;
+	try {
+		before = await readFile(target);
+	} catch {}
+	await atomicWrite(target, value.content);
+	const after = Buffer.from(value.content);
+	const path = n.paths[0]?.resolved.relative ?? value.path;
+	return result({
+		path,
+		bytes: after.byteLength,
+		sha256: digest(after)
+	}, `wrote ${after.byteLength} bytes`, [{
+		path,
+		op: before === void 0 ? "create" : "modify",
+		...before === void 0 ? {} : { beforeSha256: digest(before) },
+		afterSha256: digest(after),
+		bytes: after.byteLength
+	}]);
+});
+const patchFileTool = make("patch_file", async (input, n, _ctx, signal) => {
+	if (signal.aborted) fail("tool-transient/cancelled", "patch was cancelled");
+	const target = requiredPath(n);
+	const value = input;
+	const before = await readFile(target, "utf8");
+	let next = before;
+	for (const edit of value.edits) {
+		const count = next.split(edit.oldText).length - 1;
+		if (count !== 1) fail("tool-terminal/patch-mismatch", `expected one occurrence, found ${count}`);
+		next = next.replace(edit.oldText, edit.newText);
+	}
+	await atomicWrite(target, next);
+	const after = Buffer.from(next);
+	const path = n.paths[0]?.resolved.relative ?? value.path;
+	return result({
+		path,
+		bytes: after.byteLength,
+		sha256: digest(after),
+		edits: value.edits.length
+	}, `patched ${path}`, [{
+		path,
+		op: "modify",
+		beforeSha256: digest(Buffer.from(before)),
+		afterSha256: digest(after),
+		bytes: after.byteLength
+	}]);
+});
+const WRITE_TOOLS = Object.freeze({
+	write_file: writeFileTool,
+	patch_file: patchFileTool
+});
+//#endregion
+//#region ../../packages/tools/src/catalogue/index.ts
+const rowByName = new Map(CATALOGUE_ROWS.map((row) => [row.name, row]));
+/** `ToolIntrospection` is on the per-tool-call path (PLAN PC-4: the gate validates a call's shape without importing
+* `tools`), so the strict schema of every row is built ONCE, here: `schemaOf` returns the same object identity on
+* every call and a validator cache keyed by schema identity in the gate (U2.01/U2.02) keeps working. */
+const strictSchemaByName = new Map(CATALOGUE_ROWS.map((row) => [row.name, toStrictSchema(row.inputSchema)]));
+Compile(ToolGrant);
+const namingProblems = toolGrantProblems(CATALOGUE_ROWS.map((row) => ({ tool: row.name })));
+if (namingProblems.length > 0) throw new TypeError(`tool catalogue: ${namingProblems.join("; ")}`);
+/** Catalogue-derived: never a second, hand-written copy of what a tool's input schema says (PLAN PC-4: `security`
+* validates a call's shape and path arguments without importing `tools`). */
+const toolIntrospection = {
+	schemaOf(tool) {
+		return strictSchemaByName.get(tool);
+	},
+	pathArgsOf(tool, input) {
+		const row = rowByName.get(tool);
+		if (!row) return [];
+		return row.pathArgsOf(input);
+	}
+};
+/** The 9 V3.0 tools + the 3 seams, by name (DESIGN 2.7). Every value is `stubImplementation(name)` until Wave 2
+* replaces the bodies in `impl/**`; the metadata is already the catalogue's own. */
+const TOOL_CATALOGUE = Object.freeze({
+	...READ_TOOLS,
+	...WRITE_TOOLS,
+	...EXEC_TOOLS,
+	...STATE_TOOLS
+});
+//#endregion
+export { buildPolicySnapshot as a, createCommandPolicy as c, createGlobMatcher as i, createProgramResolver as l, toolIntrospection as n, createPolicyEngine as o, createPathResolver as r, explainPolicy as s, TOOL_CATALOGUE as t };
+
+//# sourceMappingURL=catalogue-BvwSrM_j.mjs.map